Vendor

WSO2

Security vulnerabilities in WSO2's enterprise identity and API management platforms, including WSO2 Identity Server, API Manager, and related integration products deployed across financial services and enterprise environments.

2 CVEs1 articlesRSS JSON

CVEs

CVE-2026-5430

[ CRITICAL ]CVSS 10.0EPSS 0.6%kev

WSO2 Multiple Products Path Traversal to RCE

WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway contain a path traversal flaw enabling unauthenticated file upload and remote code execution. CVSS 10.0. Actively exploited since September 13, 2026; added to CISA KEV September 24.

WSO2 / API Control Plane, API Manager, Traffic Manager, Universal GatewaySep 24

CVE-2022-29464

[ CRITICAL ]CVSS 9.8EPSS 100.0%kev

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

WSO2 / Multiple ProductsApr 25, 2022

Articles

~/articles/2026-09-17-wso2-cve-2026-5430-cvss10-jwt-bypass-exploited

wso2

WSO2 CVSS 10 JWT Bypass Exploited in the Wild

CVE-2026-5430 lets unauthenticated attackers forge JWTs and gain administrative access to WSO2 deployments. Active exploitation confirmed. Patch immediately.

Sep 17read →